meno-core 1.0.53 → 1.1.0

package/lib/server/jsonLoader.ts

@@ -3,20 +3,24 @@
  * Utilities for loading and parsing JSON files
  */
 
-import { existsSync, readdirSync } from 'fs';
+import { existsSync, readdirSync } from 'node:fs';
 import type { z } from 'zod';
 import type { ComponentDefinition } from '../shared/types';
 import type { BreakpointConfig, BreakpointConfigInput, BreakpointEntry } from '../shared/breakpoints';
 import { readTextFile, fileExists } from './runtime';
 import { DEFAULT_BREAKPOINTS, normalizeBreakpointConfig } from '../shared/breakpoints';
 import type { I18nConfig } from '../shared/types/components';
+import { createLogger } from '../shared/logger';
 import { DEFAULT_I18N_CONFIG, migrateI18nConfig } from '../shared/i18n';
 import type { PrefetchConfig } from '../shared/types/prefetch';
 import { DEFAULT_PREFETCH_CONFIG } from '../shared/types/prefetch';
 import { validateComponentDefinition } from '../shared/validation/validators';
 import { attemptJsonRepair } from '../shared/jsonRepair';
+import { logRuntimeError } from '../shared/errorLogger';
 import { projectPaths } from './projectContext';
 
+const log = createLogger('jsonLoader');
+
 /**
  * Load JSON file from a file path
  */
@@ -27,6 +31,7 @@ export async function loadJSONFile(filePath: string): Promise<string | null> {
     }
     return null;
   } catch (error) {
+    logRuntimeError('jsonLoader.loadJSONFile', error, { filePath });
     return null;
   }
 }
@@ -42,10 +47,7 @@ export function parseJSON<T = unknown>(content: string): T {
  * Parse and validate JSON content against a zod schema
  * Returns null on validation failure (for backward compatibility)
  */
-export function parseAndValidateJSON<T>(
-  content: string,
-  schema: z.ZodType<T>
-): T | null {
+export function parseAndValidateJSON<T>(content: string, schema: z.ZodType<T>): T | null {
   try {
     const parsed = JSON.parse(content);
     const result = schema.safeParse(parsed);
@@ -55,6 +57,7 @@ export function parseAndValidateJSON<T>(
     // Return parsed value anyway for backward compatibility
     return parsed as T;
   } catch (error) {
+    logRuntimeError('jsonLoader.parseAndValidateJSON', error);
     return null;
   }
 }
@@ -65,10 +68,11 @@ export function parseAndValidateJSON<T>(
 export async function loadAndParseJSON<T = any>(filePath: string): Promise<T | null> {
   const content = await loadJSONFile(filePath);
   if (!content) return null;
-  
+
   try {
     return parseJSON<T>(content);
   } catch (error) {
+    logRuntimeError('jsonLoader.loadAndParseJSON', error, { filePath });
     return null;
   }
 }
@@ -76,29 +80,27 @@ export async function loadAndParseJSON<T = any>(filePath: string): Promise<T | n
 /**
  * Load all JSON files from a directory
  */
-export async function loadJSONDirectory(
-  dirPath: string
-): Promise<Map<string, string>> {
+export async function loadJSONDirectory(dirPath: string): Promise<Map<string, string>> {
   const files = new Map<string, string>();
-  
+
   if (!existsSync(dirPath)) {
     return files;
   }
-  
+
   const fileList = readdirSync(dirPath);
-  
-  const jsonFiles = fileList.filter(f => f.endsWith('.json'));
+
+  const jsonFiles = fileList.filter((f) => f.endsWith('.json'));
   const results = await Promise.all(
-    jsonFiles.map(async file => {
+    jsonFiles.map(async (file) => {
       const name = file.replace('.json', '');
       const content = await loadJSONFile(`${dirPath}/${file}`);
       return content ? { name, content } : null;
-    })
+    }),
   );
   for (const r of results) {
     if (r) files.set(r.name, r.content);
   }
-  
+
   return files;
 }
 
@@ -112,6 +114,7 @@ async function loadFileAsText(filePath: string): Promise<string | null> {
     }
     return null;
   } catch (error) {
+    logRuntimeError('jsonLoader.loadFileAsText', error, { filePath });
     return null;
   }
 }
@@ -150,12 +153,12 @@ export interface ComponentDirectoryResult {
 async function loadSingleComponent(
   filePath: string,
   componentName: string,
-  category?: string
+  category?: string,
 ): Promise<ComponentLoadResult> {
   const content = await loadJSONFile(filePath);
   if (!content) return { component: null };
 
-  const fileName = `${componentName}.json`;
+  const _fileName = `${componentName}.json`;
   const repairResult = attemptJsonRepair(content);
 
   if (!repairResult.success) {
@@ -185,8 +188,10 @@ async function loadSingleComponent(
     // Validate component definition (logs warnings but doesn't fail - graceful degradation)
     const validationResult = validateComponentDefinition(parsed);
     if (!validationResult.valid) {
-      console.warn(`[jsonLoader] Component validation failed for ${componentName}:`,
-        validationResult.errors.map(e => `${e.path}: ${e.message}`).join('; '));
+      log.warn(
+        `Component validation failed for ${componentName}:`,
+        validationResult.errors.map((e) => `${e.path}: ${e.message}`).join('; '),
+      );
     }
     const componentDef: ComponentWithCategory = validationResult.valid ? validationResult.data : parsed;
 
@@ -196,10 +201,7 @@ async function loadSingleComponent(
     // Load .js and .css files in parallel
     const jsFilePath = `${dirPath}/${componentName}.js`;
     const cssFilePath = `${dirPath}/${componentName}.css`;
-    const [jsContent, cssContent] = await Promise.all([
-      loadFileAsText(jsFilePath),
-      loadFileAsText(cssFilePath),
-    ]);
+    const [jsContent, cssContent] = await Promise.all([loadFileAsText(jsFilePath), loadFileAsText(cssFilePath)]);
 
     if (!componentDef.component) {
       componentDef.component = {};
@@ -230,6 +232,7 @@ async function loadSingleComponent(
 
     return { component: componentDef, warning };
   } catch (error) {
+    logRuntimeError('jsonLoader.loadSingleComponent', error, { filePath, componentName });
     return { component: null };
   }
 }
@@ -245,9 +248,7 @@ async function loadSingleComponent(
  * @param dirPath - Root components directory path
  * @returns Map of component names to ComponentDefinition with category metadata
  */
-export async function loadComponentDirectory(
-  dirPath: string = './components'
-): Promise<ComponentDirectoryResult> {
+export async function loadComponentDirectory(dirPath: string = './components'): Promise<ComponentDirectoryResult> {
   const components = new Map<string, ComponentWithCategory>();
   const warnings: ComponentLoadDiagnostic[] = [];
   const errors: ComponentLoadDiagnostic[] = [];
@@ -286,10 +287,10 @@ export async function loadComponentDirectory(
 
   // Load all components in parallel
   const results = await Promise.all(
-    loadEntries.map(async e => ({
+    loadEntries.map(async (e) => ({
       ...e,
       result: await loadSingleComponent(e.filePath, e.componentName, e.category),
-    }))
+    })),
   );
 
   // Insert into map preserving listing order, with duplicate detection
@@ -299,7 +300,7 @@ export async function loadComponentDirectory(
     if (!result.component) continue;
     if (components.has(componentName)) {
       const location = category ? `category "${category}"` : 'root level';
-      console.warn(`[jsonLoader] Duplicate component name "${componentName}" found at ${location}. Skipping.`);
+      log.warn(`Duplicate component name "${componentName}" found at ${location}. Skipping.`);
       continue;
     }
     components.set(componentName, result.component);
@@ -346,9 +347,10 @@ export async function loadBreakpointConfig(): Promise<BreakpointConfig> {
             if (typeof entry.breakpoint === 'number' && entry.breakpoint > 0) {
               validInput[key] = {
                 breakpoint: entry.breakpoint,
-                previewPoint: typeof entry.previewPoint === 'number' && entry.previewPoint > 0
-                  ? entry.previewPoint
-                  : entry.breakpoint,
+                previewPoint:
+                  typeof entry.previewPoint === 'number' && entry.previewPoint > 0
+                    ? entry.previewPoint
+                    : entry.breakpoint,
               };
             }
           }
@@ -361,6 +363,7 @@ export async function loadBreakpointConfig(): Promise<BreakpointConfig> {
       }
     }
   } catch (error) {
+    logRuntimeError('jsonLoader.loadBreakpointConfig', error, { filePath: projectPaths.config() });
   }
 
   return { ...DEFAULT_BREAKPOINTS };
@@ -396,6 +399,7 @@ export async function loadI18nConfig(): Promise<I18nConfig> {
     }
   } catch (error) {
     // Fall through to default
+    logRuntimeError('jsonLoader.loadI18nConfig', error, { filePath: projectPaths.config() });
   }
 
   return { ...DEFAULT_I18N_CONFIG };
@@ -441,6 +445,7 @@ export async function loadIconsConfig(): Promise<IconsConfig> {
     }
   } catch (error) {
     // Fall through to default
+    logRuntimeError('jsonLoader.loadIconsConfig', error, { filePath: projectPaths.config() });
   }
 
   return {};
@@ -465,8 +470,8 @@ export async function loadPrefetchConfig(): Promise<PrefetchConfig> {
     }
   } catch (error) {
     // Fall through to default
+    logRuntimeError('jsonLoader.loadPrefetchConfig', error, { filePath: projectPaths.config() });
   }
 
   return { ...DEFAULT_PREFETCH_CONFIG };
 }
-

package/lib/server/middleware/cors.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from 'bun:test';
-import { createCorsHeaders, handleCorsPreflight, type CorsOptions } from './cors';
+import { createCorsHeaders, handleCorsPreflight } from './cors';
 
 describe('cors middleware', () => {
   describe('createCorsHeaders', () => {
@@ -17,14 +17,14 @@ describe('cors middleware', () => {
 
     test('handles array origin', () => {
       const headers = createCorsHeaders({
-        origin: ['https://example.com', 'https://test.com']
+        origin: ['https://example.com', 'https://test.com'],
       });
       expect(headers['Access-Control-Allow-Origin']).toBe('https://example.com, https://test.com');
     });
 
     test('handles function origin', () => {
       const headers = createCorsHeaders({
-        origin: (origin: string) => origin === 'https://example.com'
+        origin: (origin: string) => origin === 'https://example.com',
       });
       // Function origin falls back to '*' since we don't have request origin
       expect(headers['Access-Control-Allow-Origin']).toBe('*');
@@ -32,42 +32,42 @@ describe('cors middleware', () => {
 
     test('handles custom methods', () => {
       const headers = createCorsHeaders({
-        methods: ['GET', 'POST']
+        methods: ['GET', 'POST'],
       });
       expect(headers['Access-Control-Allow-Methods']).toBe('GET, POST');
     });
 
     test('handles empty methods array', () => {
       const headers = createCorsHeaders({
-        methods: []
+        methods: [],
       });
       expect(headers['Access-Control-Allow-Methods']).toBeUndefined();
     });
 
     test('handles custom allowed headers', () => {
       const headers = createCorsHeaders({
-        allowedHeaders: ['X-Custom-Header', 'Content-Type']
+        allowedHeaders: ['X-Custom-Header', 'Content-Type'],
       });
       expect(headers['Access-Control-Allow-Headers']).toBe('X-Custom-Header, Content-Type');
     });
 
     test('handles empty allowed headers array', () => {
       const headers = createCorsHeaders({
-        allowedHeaders: []
+        allowedHeaders: [],
       });
       expect(headers['Access-Control-Allow-Headers']).toBeUndefined();
     });
 
     test('sets credentials header when enabled', () => {
       const headers = createCorsHeaders({
-        credentials: true
+        credentials: true,
       });
       expect(headers['Access-Control-Allow-Credentials']).toBe('true');
     });
 
     test('does not set credentials header when disabled', () => {
       const headers = createCorsHeaders({
-        credentials: false
+        credentials: false,
       });
       expect(headers['Access-Control-Allow-Credentials']).toBeUndefined();
     });
@@ -77,7 +77,7 @@ describe('cors middleware', () => {
         origin: 'https://example.com',
         methods: ['GET', 'POST'],
         allowedHeaders: ['X-Token'],
-        credentials: true
+        credentials: true,
       });
       expect(headers['Access-Control-Allow-Origin']).toBe('https://example.com');
       expect(headers['Access-Control-Allow-Methods']).toBe('GET, POST');
@@ -87,7 +87,7 @@ describe('cors middleware', () => {
 
     test('overrides defaults with provided options', () => {
       const headers = createCorsHeaders({
-        methods: ['GET']
+        methods: ['GET'],
       });
       expect(headers['Access-Control-Allow-Methods']).toBe('GET');
       expect(headers['Access-Control-Allow-Origin']).toBe('*'); // Still defaults
@@ -97,7 +97,7 @@ describe('cors middleware', () => {
   describe('handleCorsPreflight', () => {
     test('returns null for non-OPTIONS request', () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'GET'
+        method: 'GET',
       });
       const response = handleCorsPreflight(req);
       expect(response).toBeNull();
@@ -105,7 +105,7 @@ describe('cors middleware', () => {
 
     test('returns response for OPTIONS request', () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'OPTIONS'
+        method: 'OPTIONS',
       });
       const response = handleCorsPreflight(req);
       expect(response).not.toBeNull();
@@ -114,7 +114,7 @@ describe('cors middleware', () => {
 
     test('OPTIONS response includes default CORS headers', () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'OPTIONS'
+        method: 'OPTIONS',
       });
       const response = handleCorsPreflight(req);
       expect(response?.headers.get('Access-Control-Allow-Origin')).toBe('*');
@@ -123,11 +123,11 @@ describe('cors middleware', () => {
 
     test('OPTIONS response includes custom CORS headers', () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'OPTIONS'
+        method: 'OPTIONS',
       });
       const response = handleCorsPreflight(req, {
         origin: 'https://example.com',
-        methods: ['GET', 'POST']
+        methods: ['GET', 'POST'],
       });
       expect(response?.headers.get('Access-Control-Allow-Origin')).toBe('https://example.com');
       expect(response?.headers.get('Access-Control-Allow-Methods')).toBe('GET, POST');
@@ -135,7 +135,7 @@ describe('cors middleware', () => {
 
     test('OPTIONS response has no body', async () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'OPTIONS'
+        method: 'OPTIONS',
       });
       const response = handleCorsPreflight(req);
       const body = await response?.text();
@@ -144,7 +144,7 @@ describe('cors middleware', () => {
 
     test('handles POST request', () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'POST'
+        method: 'POST',
       });
       const response = handleCorsPreflight(req);
       expect(response).toBeNull();
@@ -152,7 +152,7 @@ describe('cors middleware', () => {
 
     test('handles PUT request', () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'PUT'
+        method: 'PUT',
       });
       const response = handleCorsPreflight(req);
       expect(response).toBeNull();
@@ -160,7 +160,7 @@ describe('cors middleware', () => {
 
     test('handles DELETE request', () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'DELETE'
+        method: 'DELETE',
       });
       const response = handleCorsPreflight(req);
       expect(response).toBeNull();
@@ -168,7 +168,7 @@ describe('cors middleware', () => {
 
     test('OPTIONS with credentials option', () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'OPTIONS'
+        method: 'OPTIONS',
       });
       const response = handleCorsPreflight(req, { credentials: true });
       expect(response?.headers.get('Access-Control-Allow-Credentials')).toBe('true');

package/lib/server/middleware/cors.ts

@@ -8,6 +8,14 @@ export interface CorsOptions {
   methods?: string[];
   allowedHeaders?: string[];
   credentials?: boolean;
+  /**
+   * The incoming request's `Origin` header. When provided alongside a function
+   * or array `origin`, the matching request origin is REFLECTED (and `Vary: Origin`
+   * set) so an allow-list can be enforced per-request; a non-matching origin gets
+   * no `Access-Control-Allow-Origin` header at all (browser blocks it). When omitted,
+   * function/array origins keep their legacy permissive/joined behavior.
+   */
+  requestOrigin?: string;
 }
 
 const DEFAULT_OPTIONS: CorsOptions = {
@@ -27,10 +35,27 @@ export function createCorsHeaders(options: CorsOptions = {}): Record<string, str
   // Handle origin
   if (opts.origin) {
     if (typeof opts.origin === 'function') {
-      // Dynamic origin - would need request origin to evaluate
-      headers['Access-Control-Allow-Origin'] = '*';
+      if (opts.requestOrigin !== undefined) {
+        // Allow-list mode: reflect the request Origin only when the predicate
+        // accepts it; otherwise emit no ACAO header so the browser blocks it.
+        if (opts.origin(opts.requestOrigin)) {
+          headers['Access-Control-Allow-Origin'] = opts.requestOrigin;
+          headers.Vary = 'Origin';
+        }
+      } else {
+        // No request Origin to evaluate against — legacy permissive fallback.
+        headers['Access-Control-Allow-Origin'] = '*';
+      }
     } else if (Array.isArray(opts.origin)) {
-      headers['Access-Control-Allow-Origin'] = opts.origin.join(', ');
+      if (opts.requestOrigin !== undefined) {
+        // Allow-list mode: reflect the request Origin only when it's listed.
+        if (opts.origin.includes(opts.requestOrigin)) {
+          headers['Access-Control-Allow-Origin'] = opts.requestOrigin;
+          headers.Vary = 'Origin';
+        }
+      } else {
+        headers['Access-Control-Allow-Origin'] = opts.origin.join(', ');
+      }
     } else {
       headers['Access-Control-Allow-Origin'] = opts.origin;
     }
@@ -66,4 +91,3 @@ export function handleCorsPreflight(req: Request, options: CorsOptions = {}): Re
   }
   return null;
 }
-

package/lib/server/middleware/errorHandler.test.ts

@@ -109,7 +109,7 @@ describe('errorHandler middleware', () => {
 
     test('handles async handler with delay', async () => {
       const handler = async () => {
-        await new Promise(resolve => setTimeout(resolve, 10));
+        await new Promise((resolve) => setTimeout(resolve, 10));
         return new Response('OK');
       };
       const response = await handleRouteError(handler);
@@ -156,7 +156,7 @@ describe('errorHandler middleware', () => {
     });
 
     test('wrapped handler passes arguments correctly', async () => {
-      const handler = async (req: Request, id: string) => {
+      const handler = async (_req: Request, id: string) => {
         return new Response(`Hello ${id}`);
       };
       const wrapped = withErrorHandling(handler);
@@ -166,7 +166,7 @@ describe('errorHandler middleware', () => {
     });
 
     test('wrapped handler catches errors with arguments', async () => {
-      const handler = async (req: Request, shouldFail: boolean) => {
+      const handler = async (_req: Request, shouldFail: boolean) => {
         if (shouldFail) throw new Error('Failed');
         return new Response('OK');
       };
@@ -183,7 +183,7 @@ describe('errorHandler middleware', () => {
     test('wrapped handler preserves response headers', async () => {
       const handler = async () => {
         return new Response('OK', {
-          headers: { 'X-Custom': 'value' }
+          headers: { 'X-Custom': 'value' },
         });
       };
       const wrapped = withErrorHandling(handler);
@@ -193,7 +193,9 @@ describe('errorHandler middleware', () => {
 
     test('multiple wrapped handlers work independently', async () => {
       const handler1 = async () => new Response('One');
-      const handler2 = async () => { throw new Error('Two'); };
+      const handler2 = async () => {
+        throw new Error('Two');
+      };
 
       const wrapped1 = withErrorHandling(handler1);
       const wrapped2 = withErrorHandling(handler2);

package/lib/server/middleware/errorHandler.ts

@@ -12,11 +12,7 @@ export interface ErrorResponse {
 /**
  * Create an error response
  */
-export function createErrorResponse(
-  error: unknown,
-  status: number = 500,
-  message?: string
-): Response {
+export function createErrorResponse(error: unknown, status: number = 500, message?: string): Response {
   const errorMessage = error instanceof Error ? error.message : String(error);
   const response: ErrorResponse = {
     error: errorMessage,
@@ -40,7 +36,7 @@ export function createErrorResponse(
  */
 export async function handleRouteError(
   handler: () => Promise<Response>,
-  errorMessage: string = 'Internal server error'
+  errorMessage: string = 'Internal server error',
 ): Promise<Response> {
   try {
     return await handler();
@@ -54,10 +50,9 @@ export async function handleRouteError(
  */
 export function withErrorHandling<T extends unknown[]>(
   handler: (...args: T) => Promise<Response>,
-  errorMessage?: string
+  errorMessage?: string,
 ): (...args: T) => Promise<Response> {
   return async (...args: T) => {
     return handleRouteError(() => handler(...args), errorMessage);
   };
 }
-

package/lib/server/middleware/index.ts

@@ -6,4 +6,3 @@
 export * from './cors';
 export * from './errorHandler';
 export * from './logger';
-

package/lib/server/middleware/logger.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, beforeEach, mock } from 'bun:test';
+import { describe, test, expect } from 'bun:test';
 import { logRequest, logError, logResponseTime, withLogging, type LogOptions } from './logger';
 
 describe('logger middleware', () => {
@@ -8,7 +8,7 @@ describe('logger middleware', () => {
   describe('logRequest', () => {
     test('executes without error when enabled', () => {
       const req = new Request('http://localhost:3000/api/test', {
-        method: 'GET'
+        method: 'GET',
       });
       expect(() => logRequest(req)).not.toThrow();
     });
@@ -144,7 +144,7 @@ describe('logger middleware', () => {
     });
 
     test('wrapped handler passes arguments correctly', async () => {
-      const handler = async (req: Request, id: string) => {
+      const handler = async (_req: Request, id: string) => {
         return new Response(`ID: ${id}`);
       };
       const wrapped = withLogging(handler);
@@ -158,7 +158,7 @@ describe('logger middleware', () => {
       const options: LogOptions = {
         logRequests: false,
         logErrors: false,
-        logResponseTime: false
+        logResponseTime: false,
       };
       const wrapped = withLogging(handler, options);
       const req = new Request('http://localhost:3000/api/test');
@@ -169,7 +169,7 @@ describe('logger middleware', () => {
     test('wrapped handler preserves response headers', async () => {
       const handler = async (_req: Request) => {
         return new Response('OK', {
-          headers: { 'X-Custom': 'value' }
+          headers: { 'X-Custom': 'value' },
         });
       };
       const wrapped = withLogging(handler);
@@ -179,7 +179,7 @@ describe('logger middleware', () => {
     });
 
     test('wrapped handler with multiple arguments', async () => {
-      const handler = async (req: Request, a: number, b: number) => {
+      const handler = async (_req: Request, a: number, b: number) => {
         return new Response(`Sum: ${a + b}`);
       };
       const wrapped = withLogging(handler);
@@ -190,7 +190,9 @@ describe('logger middleware', () => {
 
     test('wrapped handler logs on success and error', async () => {
       const successHandler = async (_req: Request) => new Response('OK');
-      const errorHandler = async (_req: Request): Promise<Response> => { throw new Error('Failed'); };
+      const errorHandler = async (_req: Request): Promise<Response> => {
+        throw new Error('Failed');
+      };
 
       const wrappedSuccess = withLogging(successHandler);
       const wrappedError = withLogging(errorHandler);
@@ -205,7 +207,7 @@ describe('logger middleware', () => {
 
     test('wrapped handler handles async operations', async () => {
       const handler = async (_req: Request) => {
-        await new Promise(resolve => setTimeout(resolve, 10));
+        await new Promise((resolve) => setTimeout(resolve, 10));
         return new Response('Delayed OK');
       };
       const wrapped = withLogging(handler);